Guide · Email scams · Business

What to do in the first 24 hours after a business email scam

It often starts with a message that looks almost right: a “CEO” asking for a quiet transfer, a finance lead confirming a supplier change, or a colleague who “needs a login reset right now.”

If someone used a fake or hijacked email account to move money or steal access, the first day matters more than perfect tech skills. Speed and proof beat panic.

This checklist is for business owners and managers. It is not a substitute for your bank, a lawyer, or the police.

1. Save everything before you “clean up”

Do not delete the suspicious emails. Forwarding them to someone else can strip details that later investigations need.

Keep the originals. Take screenshots while portals still show the problem. Write down times — with timezone if you can — for calls, transfers, and password changes.

Tidying feels productive. It often destroys the trail.

2. Lock the account from a device you trust

Use a phone or computer you believe is safe — not the one you already suspect.

Change the password on the affected account. Sign out other sessions if the tool allows it. Check for strange forwarding rules; scammers love quietly redirecting mail so you never see the replies.

If you use Microsoft or Google for work email, ask whoever manages it to look for hidden rules and unexpected app access.

3. Call your bank the same day if money moved

Ask how to dispute or recall the payment. Get a reference number. Have amounts, dates, and beneficiary details ready.

Banks move faster when you call quickly. Getting money back is never guaranteed — waiting makes it harder.

4. Warn anyone who might have seen the fake message

Staff, suppliers, and clients who might act on a bad instruction need one clear rule: confirm big requests by calling a number they already know — not by replying to the suspicious thread.

A short, calm message beats silence. Silence lets the scam keep working.

5. Keep one folder for insurers and police

If you report the incident, you will need a simple story with dates. Put emails, statements, chat logs, and a short note of who authorised what in one place.

You do not need a perfect forensic report on day one. You need a coherent pack that does not live in five inboxes.

6. Get a structured review when the picture is messy

When several mailboxes, odd logins, or conflicting stories are involved, a calm investigation turns noise into a timeline, an evidence log, and clear next steps.

That is what Glial’s Digital Fraud Investigations service is for. We do not promise fund recovery, and we do not act as law enforcement or your lawyer — we help you see what happened and what to do next.